New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-64859 · CVE overview and exploitation status

EUVD-2026-60240

GHSA-6x2c-phff-wx57

GO-2026-6240

cve-program · CVE-2026-64859

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6x2c-phff-wx57
• https://github.com/QuantumNous/new-api/pull/4929
• https://github.com/QuantumNous/new-api/commit/0936e2504655a5cbf7bc3c388f6d3e2bb24916d3
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.7

euvd · EUVD-2026-60240

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6x2c-phff-wx57
• https://github.com/QuantumNous/new-api/pull/4929
• https://github.com/QuantumNous/new-api/commit/0936e2504655a5cbf7bc3c388f6d3e2bb24916d3
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.7

nvd · CVE-2026-64859

• https://github.com/QuantumNous/new-api/commit/0936e2504655a5cbf7bc3c388f6d3e2bb24916d3
• https://github.com/QuantumNous/new-api/pull/4929
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.7
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6x2c-phff-wx57

osv · GHSA-6x2c-phff-wx57

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6x2c-phff-wx57
• https://github.com/QuantumNous/new-api/pull/4929
• https://github.com/QuantumNous/new-api/commit/0936e2504655a5cbf7bc3c388f6d3e2bb24916d3
• https://github.com/QuantumNous/new-api
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.7

osv · GO-2026-6240

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6x2c-phff-wx57
• https://github.com/QuantumNous/new-api/commit/0936e2504655a5cbf7bc3c388f6d3e2bb24916d3
• https://github.com/QuantumNous/new-api/pull/4929
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.7

No related changes are available here.